Anthropic: 67% of Banned Accounts Used AI to Prep Cyberattacks

Anthropic’s new analysis of accounts banned for malicious activity between March 2025 and March 2026 shows that 560 of 832 studied accounts — or 67.3% — used AI to assist in preparing cyberattacks such as malware development.

The company mapped account activity to the MITRE ATT&CK framework and observed that AI use is shifting deeper into the attack lifecycle. While the majority of AI-enabled actions were in the preparation phase, 54 accounts (6.5%) used AI for more advanced post-compromise actions like lateral movement. Anthropic also reported a rise in the share of actors with medium-or-higher risk scores from 33% to 56% between the first and second six-month periods of the study.

For markets and corporate security budgets, these findings imply a growing demand for advanced detection, incident response and cloud security services. Companies facing increased exposure to AI-assisted attacks may see higher operational risk premiums and rising cyber insurance costs until defensive practices catch up. Security vendors and managed service providers could therefore experience stronger near-term demand.

Anthropic highlighted a November 2025 case in which an actor used agentic capabilities to chain multiple attack stages with minimal human input, noting that such behaviors are not yet fully represented in MITRE ATT&CK. The firm said it has shared findings with Verizon’s DBIR and is engaging MITRE about expanding the framework to cover AI-enabled attacker behaviors.

Market observers and security experts expect increased collaboration among AI vendors, cloud providers and regulators to harden defenses and update threat models. Anthropic stated it has implemented additional cyber safeguards at the model level and plans to continue sharing telemetry and tooling to help defenders adapt to the accelerating threat landscape.